Is this affecting only people using Cursor or all VS Code users? The article specifically mentions the Cursor marketplace. But the affected version is indeed missing on the official VS Code marketplace, was it compromised too?
VS Code extensions have always been terrible from a security perspective. This seems like it's a supply chain attack? Makes me think of Solar Winds from a few years ago.
It doesn't appear that the Claude Code harness itself was compromised, was it? or Cursor if you use Anthropic models via Cursor's API itself?
Lately I've been using a script that mounts my current working directory in a container and I put all my build tools in a Dockerfile. I also map the harness config (~/.config/opencode or whatever) to a named volume to minimize the chance a harness could grab other things off my host. I can't use it if I ask the LLMs for docker work since they need the docker socket and then all bets are off (it could just mount your root volume somewhere). I sure I could use a full QEMU VM or some other type of isolation for such devops tasks, but I haven't really looked into it yet. Guess I should.
You could also start whichever container it needs (the docker work) yourself and just have the two containers container with eachother (e.g. docker compose, without granting access to docker socket), provided that the docker work is static enough that this would work.
You could also look into user gVisor runtime for extra security.
If not, then I think you're right about full VM.
I've been eyeing Gondolin for a while for that, but haven't yet tried it.
More details from Kevin Beaumont. "Anthropic got compromised. Their Claude Code extension on Visual Studio Code and Cursor has malware in it, which creates a remote access Trojan to desktops. " https://cyberplace.social/@GossiTheDog/117528831681803563
Normal VS code doesn't even use Cursor Marketplace, right? The way this is reported lacks clarity. Do people using plain CS Code even use the Cursor Marketplace? Or am I missing something?
not just anthropic, my product that used antigravity is also leaked and copied by google, these close ai company will undoubtably steal your code, file and data.
strongly suggest put your valuable work on local llm.
It's funny that's the point where people draw the line. But that basically every API based agent is doing RCE where commands are fetched from servers is perfectly fine.
Idea: why don't all the various app stores and plugin repos use LLMs to review all submissions for security? Certainly in the human powered age that was too big a task to take on, but now it seems doable.
> Before appending, the script checks whether svc-telemetry is already in the file rather than checking for the key itself. When hunting for this activity, it’s worth checking the public-key fingerprint rather than relying solely on the comment string
63 comments
[ 0.20 ms ] story [ 43.5 ms ] threadhttps://doublepulsar.com/anthropic-hacked-to-deliver-remote-...
It doesn't appear that the Claude Code harness itself was compromised, was it? or Cursor if you use Anthropic models via Cursor's API itself?
Lately I've been using a script that mounts my current working directory in a container and I put all my build tools in a Dockerfile. I also map the harness config (~/.config/opencode or whatever) to a named volume to minimize the chance a harness could grab other things off my host. I can't use it if I ask the LLMs for docker work since they need the docker socket and then all bets are off (it could just mount your root volume somewhere). I sure I could use a full QEMU VM or some other type of isolation for such devops tasks, but I haven't really looked into it yet. Guess I should.
You could also look into user gVisor runtime for extra security.
If not, then I think you're right about full VM.
I've been eyeing Gondolin for a while for that, but haven't yet tried it.
strongly suggest put your valuable work on local llm.
------
Check whether you are impacted
The malicious extension appends the attacker's public key, labeled svc-telemetry, to your SSH authorized keys. To check for it:
On macOS, run:
On Windows, run in PowerShell: ------[1] https://cursor.com/blog/claude-code-extension-security-notic...
> Before appending, the script checks whether svc-telemetry is already in the file rather than checking for the key itself. When hunting for this activity, it’s worth checking the public-key fingerprint rather than relying solely on the comment string
(this could've been your response to remediate the problem, Anthropic. Just sayin')
[1] https://github.com/cookiengineer/check-claude-code-exfil